Claude AI Uncovers Faster 7‑Round AES Attack and Breaks HAWK‑256 Post‑Quantum Signature Scheme
What Happened — Anthropic’s Claude Mythos preview generated a key‑recovery attack against the HAWK‑256 post‑quantum signature scheme and accelerated a seven‑round AES‑128 attack by 200‑ to 800‑fold, achieving a full key‑recovery run in ~3 h 42 min on a 96‑core server.
Why It Matters for Compliance & Audit Readiness
- Demonstrates that cryptographic primitives once deemed “secure” can become exploitable, stressing the need for continuous cryptographic control mapping to SOC 2 CC6.1 (Encryption) and CC6.2 (Key Management).
- Provides concrete evidence that audit evidence must include up‑to‑date algorithm inventories and proof of periodic reassessment against emerging research.
- Aligns with Verisq’s Control Mapping capability, which automates evidence collection for cryptographic controls and flags deprecated algorithms before they become audit findings.
Who Is Affected — Organizations that rely on HAWK‑256 or reduced‑round AES in any product, service, or internal tooling—particularly SaaS, cloud‑infrastructure, and security‑product vendors.
Recommended Actions
- Review your cryptographic policy and inventory; deprecate HAWK‑256 and any use of sub‑full‑round AES.
- Map the change to SOC 2 encryption and key‑management controls; capture evidence of algorithm retirement in your continuous‑compliance platform.
- Schedule periodic cryptographic research reviews to ensure emerging attacks are reflected in your control set.
Source: The Hacker News
Technical Notes — The HAWK attack exploits a previously unused lattice symmetry; the AES‑7 attack leverages a novel meet‑in‑the‑middle technique, yielding a 200‑800× speedup. No CVE is assigned yet; the findings are disclosed in Anthropic’s research release. Source: same